How to prevent ransomware attacks, controlled folder security setup?

https://docs.microsoft.com/en-us/win...rolled-folders

Windows version 2H02
I was curious about how hard it is to do this, and is their a guide?

- - - Updated - - -

https://docs.microsoft.com/en-us/win...rolled-folders

I found this and set controlled folder access from off to on, by the way the prior menu page said everything was ok even with controlled folder access off.

With it set to on, how do I add which programs can access the drives? I have things like OpenCPN charts program, Malwarebytes, Chrome...

- - - Updated - - -

Well, it seems to be relatively easy. My controlled folders are documents, pictures, videos, favorites, music. All very generic ones, so the charts folder is not protected yet.

Is there any downside to doing this, how many of you use this?

- - - Updated - - -

more Info here
How to Protect Your Files From Ransomware With Windows Defender’s New “Controlled Folder Access”

At the end of the day, the best defense against ransomware is frequent full disk image backups.

That said, security is a problem of multiple "points of protection".

You're looking at just one.

A few considerations -

The router - strong passwords, open ports, firewall config, wifi security

The network - split between the router (WAN to LAN protection) and devices (LAN to LAN protection).

The device - strong passwords, firewall config, OS patching, AV/AM protection.

The applications - application patching, permission levels, sandboxing.

The account - Standard User or Administrator. Principle of "least privilege".

The data - Frequent disk imaging, frequent backups of volatile data between images, testing backups, storing copies offline.

A checklist prefaced with "Do I use", "Do I have", "Do I do", on the appropriate line item, makes it easy to go down that list.

So far have not noticed any downside to using controlled folder access. It slows nothing down, and I am not running a lot of odd downloaded programs needing access to these folders. I suppose you could protect every folder on every connected drive and you would not notice much of an issue accessing your files?

Can you select the root drive c: ?, and every subfolder would also be protected?

I use Malwarebytes Anti-Ransomware instead of "controlled folder access".

Matthew Wai said:

I use Malwarebytes Anti-Ransomware instead of "controlled folder access".

still in beta since 2016, download this one?
Box
Tried to install, guess not, incompatible with antimalware bytes installed which it says already has this functionality.
Difference is malwarebytes is not free, whereas windows version of protection is built into windows.

sdowney717 said:

Tried to install, guess not, incompatible with antimalware bytes installed which it says already has this functionality.

It means the paid version of Malwarebytes already protects against ransomware.
I use this free version: https://forums.malwarebytes.com/foru...nsomware-beta/

Matthew Wai said:

It means the paid version of Malwarebytes already protects against ransomware.
I use this free version: https://forums.malwarebytes.com/foru...nsomware-beta/

Nice idea. I do have the Malwarebytes free version installed, so can not run them at the same time.

AndreTen said:

Really not recommended. I'm using controlled folder since MS brought it up, and had have no (significant) problems. But once in a while I have to save some files from apps in the unprotected folder. This is in the case, when I really don't want to allow specific app to have access to my controlled folders.

If all my drive would be protected, I would be scared to perform any update, or upgrade to the system!

Except MS programs should all have access by nature of them being of Microsoft origen, I would think so. Failed upgrades, you can always reinstall the os and keep your user files and folders right?

So far I don't run any program impacted yet by a controlled access folder. It is supposed to warn you if it is, then you click to allow it.